RHSA-2019:3701

Vulnerability from csaf_opensuse - Published: 2019-11-05 00:00 - Updated: 2026-09-20 11:06
Summary
security update for curl
Severity
Moderate
Notes
Title of the patch: security update for curl
Description of the patch: This security update provides a functional equivalent of RHSA-2019:3701. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2019:3701.
Patchnames: RHSA-2019:3701
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2018-16890
3.1 (Low)
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2018-20483
6.2 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 7 products, the same list as for CVE-2018-16890
Threats
Impact moderate
CVE-2019-3822
7.5 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-16890
Threats
Impact moderate
CVE-2019-3823
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
Recommended 7 products, the same list as for CVE-2018-16890
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2019:3701.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2019:3701.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2019:3701",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2019_3701.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16890 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16890/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20483 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20483/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-3822 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-3822/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-3823 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-3823/"
      }
    ],
    "title": "security update for curl",
    "tracking": {
      "current_release_date": "2026-09-20T11:06:07Z",
      "generator": {
        "date": "2019-11-05T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2019:3701",
      "initial_release_date": "2019-11-05T00:00:00Z",
      "revision_history": [
        {
          "date": "2019-11-05T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:06:07Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-11.el8.i686",
                "product": {
                  "name": "libcurl-0:7.61.1-11.el8.i686",
                  "product_id": "libcurl-0:7.61.1-11.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl@7.61.1-11.el8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-11.el8.i686",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-11.el8.i686",
                  "product_id": "libcurl-devel-0:7.61.1-11.el8.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:haxx:curl:7.61.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libcurl-devel@7.61.1-11.el8?arch=i686\u0026upstream=curl-0:7.61.1-11.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-11.el8.i686",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-11.el8.i686",
                  "product_id": "libcurl-minimal-0:7.61.1-11.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl-minimal@7.61.1-11.el8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-11.el8.x86_64",
                "product": {
                  "name": "curl-0:7.61.1-11.el8.x86_64",
                  "product_id": "curl-0:7.61.1-11.el8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:haxx:curl:7.61.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/curl@7.61.1-11.el8?arch=x86_64\u0026upstream=curl-0:7.61.1-11.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-11.el8.x86_64",
                "product": {
                  "name": "libcurl-0:7.61.1-11.el8.x86_64",
                  "product_id": "libcurl-0:7.61.1-11.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl@7.61.1-11.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-11.el8.x86_64",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-11.el8.x86_64",
                  "product_id": "libcurl-devel-0:7.61.1-11.el8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:haxx:curl:7.61.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libcurl-devel@7.61.1-11.el8?arch=x86_64\u0026upstream=curl-0:7.61.1-11.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-11.el8.x86_64",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-11.el8.x86_64",
                  "product_id": "libcurl-minimal-0:7.61.1-11.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl-minimal@7.61.1-11.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-11.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64"
        },
        "product_reference": "curl-0:7.61.1-11.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-11.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686"
        },
        "product_reference": "libcurl-0:7.61.1-11.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-11.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64"
        },
        "product_reference": "libcurl-0:7.61.1-11.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-11.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686"
        },
        "product_reference": "libcurl-devel-0:7.61.1-11.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-11.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64"
        },
        "product_reference": "libcurl-devel-0:7.61.1-11.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-11.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-11.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-11.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-11.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-16890",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16890"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16890",
          "url": "https://www.suse.com/security/cve/CVE-2018-16890"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123371 for CVE-2018-16890",
          "url": "https://bugzilla.suse.com/1123371"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123378 for CVE-2018-16890",
          "url": "https://bugzilla.suse.com/1123378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141798 for CVE-2018-16890",
          "url": "https://bugzilla.suse.com/1141798"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-11-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16890"
    },
    {
      "cve": "CVE-2018-20483",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20483"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file\u0027s origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20483",
          "url": "https://www.suse.com/security/cve/CVE-2018-20483"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1120382 for CVE-2018-20483",
          "url": "https://bugzilla.suse.com/1120382"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-11-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20483"
    },
    {
      "cve": "CVE-2019-3822",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-3822"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large \u0027nt response\u0027 data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a \u0027large value\u0027 needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-3822",
          "url": "https://www.suse.com/security/cve/CVE-2019-3822"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123377 for CVE-2019-3822",
          "url": "https://bugzilla.suse.com/1123377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141798 for CVE-2019-3822",
          "url": "https://bugzilla.suse.com/1141798"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-11-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-3822"
    },
    {
      "cve": "CVE-2019-3823",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-3823"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn\u0027t NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
          "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-3823",
          "url": "https://www.suse.com/security/cve/CVE-2019-3823"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123378 for CVE-2019-3823",
          "url": "https://bugzilla.suse.com/1123378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1126909 for CVE-2019-3823",
          "url": "https://bugzilla.suse.com/1126909"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141798 for CVE-2019-3823",
          "url": "https://bugzilla.suse.com/1141798"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:curl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-devel-0:7.61.1-11.el8.x86_64",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.i686",
            "SUSE Liberty Linux 8:libcurl-minimal-0:7.61.1-11.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-11-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-3823"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.